The Top 25 Most Dangerous Software Errors

'Improper Restriction of Operations within the Bounds of a Memory Buffer' tops this year's list.

Larry Loeb, Blogger, Informationweek

November 29, 2019

3 Min Read

The Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Errors (CWE Top 25) is a list of what has been judged to be the most widespread and critical weaknesses that can lead to serious vulnerabilities in software. These kinds of weaknesses are often easy to find and exploit. They can be dangerous because they can frequently allow threat actors to completely take over execution of software, steal data, or prevent the software from working.

MITRE is saying that this current list is data driven in how it has been approached; using Common Vulnerabilities and Exposures (CVE) data and related CWE mappings that are found within the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), as well as the Common Vulnerability Scoring System (CVSS) scores associated with each of the CVEs. A scoring formula was then applied by MITRE to determine the level of prevalence and danger each weakness presents.

At the time of the last list compilation eight years ago, the top spot of the list was taken by SQL injection techniques. The 2011 list was constructed by a different method; from surveys conducted of developers, top security analysts, researchers and vendors. It involved some subjectivity on the part of those surveyed.

But this year, it's "Improper Restriction of Operations within the Bounds of a Memory Buffer" as top dog which shows the changes that have happened to the list. The current top spot is a class level of wide-ranging errors, not one bugaboo. The data-driven approach to generating the list gave rise to solidifying root causes of multiple vulnerabilities into one class-level description.

The 2019 CWE Top 25 leverages NVD data from the years 2017 and 2018, which consisted of approximately 25,000 CVEs. The scoring formula combines the frequency that a CWE is the root cause of a vulnerability with the projected severity of its exploitation. In both cases, the frequency and severity are normalized relative to the minimum and maximum values seen.

So, what kinds of problems will not show up in the list? Weaknesses that are rarely exploited will not receive a high score, regardless of the typical severity associated with any exploitation. Weaknesses with a low impact will not receive a high score, which makes sense. It makes sense that weaknesses that are both common and can cause harm should receive a high score.

The methodology does have limitations. This approach to the list only uses data that was publicly reported and captured in NVD, and there are numerous vulnerabilities exist that do not have CVE IDs. Vulnerabilities which are not included in NVD will be excluded from this approach. The authors of the list also admit that it indirectly prioritizes implementation flaws over design flaws, due to their prevalence within individual software packages.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Read more about:

Security Now

About the Author

Larry Loeb

Blogger, Informationweek

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange. His first Mac had 128 KB of memory, which was a big step up from his first 1130, which had 4 KB, as did his first 1401. You can e-mail him at [email protected].

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights